NVCOAS.EXE is using too much CPU power and interferes noticeably with other applications/work

Problem description

If you see NVCOAS.EXE (Norman Virus Control On Access Scanner) constantly using the CPU heavily, the scanner is getting too many scan requests.

What is the Norman Virus Control On-Access Scanner (NVCOAS) and what does it do?

The On Access Scanner is the component that is invoked every time you access any file. Whenever a user on an application uses a file, NVCOAS will need to scan it to make sure it does not contain viruses before the file is actually used. This scanning process of course requires some computing power every time any file is accessed.

What happens when the OAS is using so much CPU time that it affects the rest of my work?

In that case, a certain file is scanned extremely often, or a large number of files are scanned in a very short time. This makes the queue of files that need to be scanned grow quicker than the scanner is able to handle. When this happens for only a few seconds at a time there is usually no problem - this is normal and the CPU usage will automatically decrease very quickly after the peak has passed. This can happen for instance if you start a heavy application that reads and writes frequently to a large amount of files in a very short period of time (like photo/video editing software, or a database that consists of a huge number of files). If however the CPU usage remains high for prolonged periods ot time or constantly hinders normal operation, the situation that too many file access attempts happen in too short a time will need to be remedied by making sure the scanner does not scan the files in question any more (excluding them from scanning).

Known examples that our support department sometimes comes across are logfiles created by intensively logging applications, like busy email servers, or applications which access their configuration and/or log files very often.

Solution

What can be done to remedy the situation?

The file(s) or folder(s) that is/are accessed too often (and thus scanned by the On-Access Scanner too often) will need to be excluded from scanning, so that they will no longer be scanned for viruses every time they are accessed. This will relieve pressure on the scanner and thus on your CPU.

How can I find out what files are scanned too often?

There is an efficient way of finding out what exactly is filling up the queue too quickly. You can use the free Process Monitor tool from Microsoft SysInternals. This program logs a large amount of information about the actions that various processes take. In this case you are interested in the actions of nvcoas.exe so you can filter for that.

Execute the unpacked ProcMon.exe, go to the Filter menu, and choose the Filter option.

Add a new filter item with the following settings: Process Name - is - nvcoas.exe (then) include. Click OK when done.
This makes Process Monitor only show the actions whenever nvcoas.exe is concerned (though it will keep logging all other processes too, they will just not be shown).

Let procmon log for about a minute while the problem is occuring. This is normally enough to get a clear picture of what is being scanned too often. If at the end of these instructions the results are inconclusive, please repeat the whole procedure only give it more time to allow Process Monitor to collect more data.

Go to the Tools menu, and choose the Count Occurences option.

Set the Column setting to Path, and click Count.
Wait for the counting to be procesed, this can take quite some time as there might be a huge collection of data to calculate.

Sort the resulting table for the Count column (by clicking Count). This should indicate which file(s) that is(are) accessed extremely often, and thus need to be excluded from scanning to releave pressure on the on-access scanner (and thus the CPU). As described in the introduction, this exclusion is necessary because these files are accessed so often that the on-access scanner is not able to complete all scan requests in time, and the queue fills up quicker than the scanner can handle.

Exclude files or folders in Norman Virus Control's Common Settings section of the Configuration Editor (reachable through the N icon in the system tray). If you add a file or a folder in the exclusion list, the On-Access Scanner will no longer scan any file or folder that corresponds with entries in the exclusion list, saving CPU power for all other files that are not in the exclusion list and thus need to be scanned.

After following these instructions, you should see the CPU usage by nvcoas.exe quickly decreases. If not, there is probably another file or folder that needs to be excluded from scanning. Just repeat the procedure and add more exclusions if necessary. If you feel you have excluded enough files or folders and still have problems, please contact your local Norman support office for further assistance.

Note

Be careful with what you exclude. Think it through thoroughly. By default all files and subfolders will be excluded if you exclude a folder. For example, excluding C:\WINDOWS is a bad idea. You will in general want to reduce exclusions as much as possible.